hiclaw-multi-agent-collaboration

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). While many links are to legitimate resources (GitHub, hiclaw.io, matrix.org, higress.io helm repo), the presence of direct installer scripts (https://higress.ai/hiclaw/install.sh and install.ps1) and the Nacos skill registry endpoints (which accept/upload code) makes these URLs potentially usable to distribute and execute arbitrary code if the sources or registries are untrusted or compromised, so they should be treated as suspicious until verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via Matrix room messages (Element IM client) that the Manager/Workers read at runtime to plan/delegate tasks, and those messages are authored by other humans in the room (outsiders relative to the operating user).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes explicit runtime commands that fetch and execute remote code — e.g., bash <(curl -sSL https://higress.ai/hiclaw/install.sh) and the PowerShell iex of https://higress.ai/hiclaw/install.ps1, runtime npx invocations that pull and run npm packages (e.g. npx -y @modelcontextprotocol/server-filesystem, @modelcontextprotocol/server-postgres, @modelcontextprotocol/server-github, @modelcontextprotocol/server-git), and remote skill loading via the Nacos endpoint (http://nacos-server:8848/nacos/v1/cs/configs) — all of which are fetched/used at runtime and execute or supply code that the agents rely on.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt explicitly tells users to bypass PowerShell execution policy (Set-ExecutionPolicy Bypass) and to run remote installer scripts plus helm/kubectl commands that modify system or cluster state, which encourages bypassing security controls and altering the machine's state.